{"id":2793,"date":"2026-11-08T22:24:21","date_gmt":"2026-11-08T22:24:21","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2793"},"modified":"2026-11-08T22:24:23","modified_gmt":"2026-11-08T22:24:23","slug":"portswigger-business-logic-lab-11-authentication-bypass-via-encryption-oracle","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/11\/08\/portswigger-business-logic-lab-11-authentication-bypass-via-encryption-oracle\/","title":{"rendered":"PortSwigger Business Logic Lab 11: Authentication Bypass via Encryption Oracle"},"content":{"rendered":"\n

Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cAuthentication bypass via encryption oracle\u201d senaryosunu inceliyoruz. Uygulaman\u0131n yorum hatalar\u0131 i\u00e7in kulland\u0131\u011f\u0131 \u015fifreli bildirim mekanizmas\u0131, se\u00e7ti\u011fimiz verileri \u015fifrelememize ve \u015fifreli cookie de\u011ferlerinin i\u00e7eri\u011fini g\u00f6rmemize olanak tan\u0131yor. Amac\u0131m\u0131z, bu mekanizmadan yararlanarak administrator hesab\u0131 i\u00e7in ge\u00e7erli bir oturum cookie\u2019si olu\u015fturmak, admin panele eri\u015fmek ve carlos kullan\u0131c\u0131s\u0131n\u0131 silmek. Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n

wiener:peter credential\u2019lar\u0131m\u0131z yine var ve bizden carlos kullan\u0131c\u0131s\u0131n\u0131 silmemiz isteniyor. Laba g\u00f6re asl\u0131nda \u015fifreleme taraf\u0131nda bir hatadan kaynakl\u0131 bizim bunu yapabilece\u011fimizi dile getiriyor. Bunun \u00fczerine ben de cookie’lere bakmaya karar verdim \u00e7\u00fcnk\u00fc burada bir farkl\u0131l\u0131k vard\u0131. Oturumun a\u00e7\u0131k kalmas\u0131 i\u00e7in bir checkbox eklenmi\u015f bu \u015fekilde giri\u015f yap\u0131ld\u0131\u011f\u0131nda a\u015fa\u011f\u0131daki gibi bize bir cookie atan\u0131yor.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Atanan yeni cookie de\u011feri: TA58IAJxdARKwFjvps%2fViW3czuT2yw%2fUdT4OQyyb0Gg%3d<\/p>\n\n\n\n

Buradaki \u015fifrelemeyi \u00e7\u00f6zemedim ve bunun \u00fczerine uygulamay\u0131 ke\u015ffetmeye ba\u015flad\u0131m. Ge\u00e7ersiz bir e-posta ile yorum yapmak istedi\u011fimizde uygulama hata veriyor ve hata metnini de \u015fifreleyerek g\u00f6nderiyordu.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Hatal\u0131 metnin i\u00e7eri\u011fi de ekranda g\u00f6steriliyordu.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Ayn\u0131 olabilir ihtimali ile cookie de\u011ferimi buraya g\u00f6nderdim ve…<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Asl\u0131nda username:timestamp oldu\u011funu g\u00f6rd\u00fcm. Bunun \u00fczerine asl\u0131nda benim elde etmem gereken administrator:timestamp olacakt\u0131. Ben de bu sefer e-posta k\u0131sm\u0131na bunu yazd\u0131m.<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

De\u011ferim geldi ama o \u00f6n\u00fcne birka\u00e7 de\u011fer daha ekledi: Invalid…<\/p>\n\n\n\n

\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n

Tam istedi\u011fim metni \u015fifreleyememi\u015ftim. Bundan dolay\u0131 \u015fifreleme belki blok \u015fifredir umuduyla padding ekleyip denemeler yapt\u0131m. Toplam uzunlu\u011fu kontrol ettim.<\/p>\n\n\n\n

Birka\u00e7 deneme ile \u015fifrelemenin 32 bloklarla yap\u0131ld\u0131\u011f\u0131 anla\u015f\u0131l\u0131yor. Tam ortas\u0131ndan kesebilmemiz i\u00e7in bizim 32\u2019den sonra administrator ifadesini ba\u015flatmam\u0131z laz\u0131m.<\/p>\n\n\n\n

>>> len(\"Invalid email address: \")\n23\n>>> 32-23\n9<\/code><\/pre>\n\n\n\n
Bundan dolay\u0131 bizim 9 tane padding’e ihtiyac\u0131m\u0131z var.<\/p>\n\n\n\n
>>> \"a\"*9+\"administrator:1794171801839\"\n'aaaaaaaaaadministrator:1794171801839'<\/code><\/pre>\n\n\n\n
\u0130\u015fte yeni \u015fifrelenmi\u015f metin bu \u015fekilde:<\/p>\n\n\n\n
\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n
Burada amac\u0131m\u0131z bunu decode etmek olacak ve daha sonras\u0131nda hex olarak silece\u011fiz. Silmeden \u00f6nce bu \u015fekilde:<\/p>\n\n\n\n
\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n
Sildikten sonra ve gerekli encode i\u015flemlerini yap\u0131nca…<\/p>\n\n\n\n
\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n
Ve test etti\u011fimizde de do\u011fru cevab\u0131 alabiliyoruz.<\/p>\n\n\n\n
\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n
Art\u0131k mevcut cookie’yi de\u011fi\u015ftirip admin sayfas\u0131na gidebiliriz.<\/p>\n\n\n\n
\"\"
Screenshot<\/figcaption><\/figure>\n\n\n\n
Hesab\u0131 silince de lab \u00e7\u00f6z\u00fclm\u00fc\u015f olunacakt\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"
Bu labda, PortSwigger Web Security Academy\u2019nin Business Logic kategorisindeki \u201cAuthentication bypass via encryption oracle\u201d senaryosunu inceliyoruz. Uygulaman\u0131n yorum hatalar\u0131 i\u00e7in kulland\u0131\u011f\u0131 \u015fifreli bildirim mekanizmas\u0131, se\u00e7ti\u011fimiz…<\/p>\n
Devam\u0131n\u0131 okuPortSwigger Business Logic Lab 11: Authentication Bypass via Encryption Oracle<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[753],"class_list":["post-2793","post","type-post","status-publish","format-standard","hentry","category-web","tag-business-logic","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2793"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2793\/revisions"}],"predecessor-version":[{"id":2805,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2793\/revisions\/2805"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}